Proof of Concept - Deploying Red Hat Quay

Procedure

1. Install the latest RHEL 9 server. You can do a minimal, shell-access only install, or Server plus GUI if you want a desktop.
2. Register and subscribe your RHEL server system as described in How to register and subscribe a RHEL system to the Red Hat Customer Portal using Red Hat Subscription-Manager

3. Enter the following commands to register your system and list available subscriptions. Choose an available RHEL server subscription, attach to its pool ID, and upgrade to the latest software:

   # subscription-manager register --username=<user_name> --password=<password>
   # subscription-manager refresh
   # subscription-manager list --available
   # subscription-manager attach --pool=<pool_id>
   # yum update -y

   Copy to Clipboard Toggle word wrap

Procedure

1. Set up authentication to registry.redhat.io by following the Red Hat Container Registry Authentication procedure. Setting up authentication allows you to pull the Quay container.

   Note

   This differs from earlier versions of Red Hat Quay, when the images were hosted on Quay.io.

2. Enter the following command to log in to the registry:

   $ sudo podman login registry.redhat.io

   Copy to Clipboard Toggle word wrap

   You are prompted to enter your username and password.

Procedure

1. Enter the following command to obtain your static IP address for your host system:

   $ ip a

   Copy to Clipboard Toggle word wrap

   Example output

   ---
       link/ether 6c:6a:77:eb:09:f1 brd ff:ff:ff:ff:ff:ff
       inet 192.168.1.132/24 brd 192.168.1.255 scope global dynamic noprefixroute wlp82s0
   ---

   Copy to Clipboard Toggle word wrap

2. Add the IP address and a local hostname, for example, quay-server.example.com to your /etc/hosts file that will be used to reach the Red Hat Quay endpoint. You can confirm that the IP address and hostname have been added to the /etc/hosts file by entering the following command:

   $ cat /etc/hosts

   Copy to Clipboard Toggle word wrap

   Example output

   192.168.1.132 quay-server.example.com

   Copy to Clipboard Toggle word wrap

Procedure

1. In the installation folder, denoted here by the $QUAY variable, create a directory for the database data by entering the following command:

   $ mkdir -p $QUAY/postgres-quay

   Copy to Clipboard Toggle word wrap

2. Set the appropriate permissions by entering the following command:

   $ setfacl -m u:26:-wx $QUAY/postgres-quay

   Copy to Clipboard Toggle word wrap

3. Start the Postgres container, specifying the username, password, and database name and port, with the volume definition for database data:

   $ sudo podman run -d --rm --name postgresql-quay \
     -e POSTGRESQL_USER=quayuser \
     -e POSTGRESQL_PASSWORD=quaypass \
     -e POSTGRESQL_DATABASE=quay \
     -e POSTGRESQL_ADMIN_PASSWORD=adminpass \
     -p 5432:5432 \
     -v $QUAY/postgres-quay:/var/lib/pgsql/data:Z \
     registry.redhat.io/rhel8/postgresql-13

   Copy to Clipboard Toggle word wrap

4. Ensure that the Postgres pg_trgm module is installed by running the following command:

   $ sudo podman exec -it postgresql-quay /bin/bash -c 'echo "CREATE EXTENSION IF NOT EXISTS pg_trgm" | psql -d quay -U postgres'

   Copy to Clipboard Toggle word wrap
   Note

   The pg_trgm module is required for the Quay container.

Procedure

1. Enter the following command to create a minimal config.yaml file that is used to deploy the Red Hat Quay container:

   $ touch config.yaml

   Copy to Clipboard Toggle word wrap

2. Copy and paste the following YAML configuration into the config.yaml file:

   BUILDLOGS_REDIS:
       host: quay-server.example.com
       password: strongpassword
       port: 6379
   CREATE_NAMESPACE_ON_PUSH: true
   DATABASE_SECRET_KEY: a8c2744b-7004-4af2-bcee-e417e7bdd235
   DB_URI: postgresql://quayuser:quaypass@quay-server.example.com:5432/quay
   DISTRIBUTED_STORAGE_CONFIG:
       default:
           - LocalStorage
           - storage_path: /datastorage/registry
   DISTRIBUTED_STORAGE_DEFAULT_LOCATIONS: []
   DISTRIBUTED_STORAGE_PREFERENCE:
       - default
   FEATURE_MAILING: false
   SECRET_KEY: e9bd34f4-900c-436a-979e-7530e5d74ac8
   SERVER_HOSTNAME: quay-server.example.com
   SETUP_COMPLETE: true
   USER_EVENTS_REDIS:
       host: quay-server.example.com
       password: strongpassword
       port: 6379

   Copy to Clipboard Toggle word wrap

3. Create a directory to copy the Red Hat Quay configuration bundle to:

   $ mkdir $QUAY/config

   Copy to Clipboard Toggle word wrap

4. Copy the Red Hat Quay configuration file to the directory:

   $ cp -v config.yaml $QUAY/config

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a local directory that will store registry images by entering the following command:

   $ mkdir $QUAY/storage

   Copy to Clipboard Toggle word wrap

2. Set the directory to store registry images:

   $ setfacl -m u:1001:-wx $QUAY/storage

   Copy to Clipboard Toggle word wrap

Procedure

1. To test pushing and pulling images from the Red Hat Quay registry, first pull a sample image from an external registry:

   $ sudo podman pull busybox

   Copy to Clipboard Toggle word wrap

   Example output

   Trying to pull docker.io/library/busybox...
   Getting image source signatures
   Copying blob 4c892f00285e done
   Copying config 22667f5368 done
   Writing manifest to image destination
   Storing signatures
   22667f53682a2920948d19c7133ab1c9c3f745805c14125859d20cede07f11f9

   Copy to Clipboard Toggle word wrap

2. Enter the following command to see the local copy of the image:

   $ sudo podman images

   Copy to Clipboard Toggle word wrap

   Example output

   REPOSITORY                          TAG      IMAGE ID       CREATED         SIZE
   docker.io/library/busybox           latest   22667f53682a   14 hours ago    1.45 MB

   Copy to Clipboard Toggle word wrap

3. Enter the following command to tag this image, which prepares the image for pushing it to the registry:

   $ sudo podman tag docker.io/library/busybox quay-server.example.com/quayadmin/busybox:test

   Copy to Clipboard Toggle word wrap

4. Push the image to your registry. Following this step, you can use your browser to see the tagged image in your repository.

   $ sudo podman push --tls-verify=false quay-server.example.com/quayadmin/busybox:test

   Copy to Clipboard Toggle word wrap

   Example output

   Getting image source signatures
   Copying blob 6b245f040973 done
   Copying config 22667f5368 done
   Writing manifest to image destination
   Storing signatures

   Copy to Clipboard Toggle word wrap

5. To test access to the image from the command line, first delete the local copy of the image:

   $ sudo podman rmi quay-server.example.com/quayadmin/busybox:test

   Copy to Clipboard Toggle word wrap

   Example output

   Untagged: quay-server.example.com/quayadmin/busybox:test

   Copy to Clipboard Toggle word wrap

6. Pull the image again, this time from your Red Hat Quay registry:

   $ sudo podman pull --tls-verify=false quay-server.example.com/quayadmin/busybox:test

   Copy to Clipboard Toggle word wrap

   Example output

   Trying to pull quay-server.example.com/quayadmin/busybox:test...
   Getting image source signatures
   Copying blob 6ef22a7134ba [--------------------------------------] 0.0b / 0.0b
   Copying config 22667f5368 done
   Writing manifest to image destination
   Storing signatures
   22667f53682a2920948d19c7133ab1c9c3f745805c14125859d20cede07f11f9

   Copy to Clipboard Toggle word wrap

Procedure

1. Access the Superuser Admin Panel on the Red Hat Quay UI by clicking on the current user’s name or avatar in the navigation pane of the UI. Then, click Superuser Admin Panel.

   

   On this page, you can manage users, your organization, service keys, view change logs, view usage logs, and create global messages for your organization.

Procedure

1. Copy the root CA file to one of /etc/containers/certs.d/ or /etc/docker/certs.d/. Use the exact path determined by the server hostname, and name the file ca.crt:

   $ sudo cp rootCA.pem /etc/containers/certs.d/quay-server.example.com/ca.crt

   Copy to Clipboard Toggle word wrap

2. Verify that you no longer need to use the --tls-verify=false option when logging in to your Red Hat Quay registry:

   $ sudo podman login quay-server.example.com

   Copy to Clipboard Toggle word wrap

   Example output

   Login Succeeded!

   Copy to Clipboard Toggle word wrap

Procedure

1. Enter the following command to copy the rootCA.pem file to the consolidated system-wide trust store:

   $ sudo cp rootCA.pem /etc/pki/ca-trust/source/anchors/

   Copy to Clipboard Toggle word wrap

2. Enter the following command to update the system-wide trust store configuration:

   $ sudo update-ca-trust extract

   Copy to Clipboard Toggle word wrap

3. Optional. You can use the trust list command to ensure that the Quay server has been configured:

   $ trust list | grep quay
       label: quay-server.example.com

   Copy to Clipboard Toggle word wrap

   Now, when you browse to the registry at https://quay-server.example.com, the lock icon shows that the connection is secure:

   

4. To remove the rootCA.pem file from system-wide trust, delete the file and update the configuration:

   $ sudo rm /etc/pki/ca-trust/source/anchors/rootCA.pem

   Copy to Clipboard Toggle word wrap

   $ sudo update-ca-trust extract

   Copy to Clipboard Toggle word wrap

   $ trust list | grep quay

   Copy to Clipboard Toggle word wrap

Procedure

1. In your Red Hat Quay config.yaml file, set the FEATURE_LISTEN_IP_VERSION field to IPv6. For example:

   # ...
   FEATURE_LISTEN_IP_VERSION: dual-stack
   # ...

   Copy to Clipboard Toggle word wrap

2. Enter the following command to start the Quay registry container, specifying the appropriate volumes for configuration data and local storage for image data. Note that if you are using dual-stack, you must specify explicit IPv6 port mapping when starting the container.

   $ sudo podman run -d --rm -p "[::]:80:8080" -p "[::]:443:8443"  \
      --name=quay \
      -v $QUAY/config:/conf/stack:Z \
      -v $QUAY/storage:/datastorage:Z \
      registry.redhat.io/quay/quay-rhel8:v3.14.5

   Copy to Clipboard Toggle word wrap